Skip to content

gh-144833: Fix use-after-free in SSL module when SSL_new() fails#144843

Merged
gpshead merged 1 commit intopython:mainfrom
raminfp:fix-ssl-uaf-newPySSLSocket
Feb 16, 2026
Merged

gh-144833: Fix use-after-free in SSL module when SSL_new() fails#144843
gpshead merged 1 commit intopython:mainfrom
raminfp:fix-ssl-uaf-newPySSLSocket

Conversation

@raminfp
Copy link
Contributor

@raminfp raminfp commented Feb 15, 2026 •
edited
Loading

Summary

Fix use-after-free and type confusion in newPySSLSocket() when SSL_new() returns NULL.

In Modules/_ssl.c, when SSL_new() fails, Py_DECREF(self) was called before _setSSLError(get_state_ctx(self), ...), causing two bugs:

  1. Use-after-free: Py_DECREF(self) frees the object, then get_state_ctx(self) dereferences freed memory.
  2. Type confusion: get_state_ctx() expects PySSLContext* but receives PySSLSocket*.

Fix

  • Call _setSSLError() before Py_DECREF(self)
  • Use sslctx (PySSLContext*) instead of self (PySSLSocket*) for get_state_ctx()
// Before:
if (self->ssl == NULL) {
    Py_DECREF(self);
    _setSSLError(get_state_ctx(self), NULL, 0, __FILE__, __LINE__);
    return NULL;
}

// After:
if (self->ssl == NULL) {
    _setSSLError(get_state_ctx(sslctx), NULL, 0, __FILE__, __LINE__);
    Py_DECREF(self);
    return NULL;
}

Fixes gh-144833

@bedevere-app bedevere-app bot mentioned this pull request Feb 15, 2026
Closed
@raminfp raminfp force-pushed the fix-ssl-uaf-newPySSLSocket branch from ec942e4 to 31e6227 Compare February 15, 2026 16:45
@raminfp
pythongh-144833: Fix use-after-free in SSL module when SSL_new() fails
b50c8cc 
In newPySSLSocket(), when SSL_new() returns NULL, Py_DECREF(self)
was called before _setSSLError(get_state_ctx(self), ...), causing
a use-after-free. Additionally, get_state_ctx() was called with
self (PySSLSocket*) instead of sslctx (PySSLContext*), which is
a type confusion bug.

Fix by calling _setSSLError() before Py_DECREF() and using
sslctx instead of self for get_state_ctx().
@raminfp raminfp force-pushed the fix-ssl-uaf-newPySSLSocket branch from 31e6227 to b50c8cc Compare February 15, 2026 16:53
@gpshead gpshead self-assigned this Feb 16, 2026
@gpshead gpshead added needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes labels Feb 16, 2026
@gpshead gpshead merged commit c91638c into python:main Feb 16, 2026
61 checks passed
@miss-islington-app
Copy link

miss-islington-app bot commented Feb 16, 2026

Thanks @raminfp for the PR, and @gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.11, 3.12, 3.13, 3.14.
🐍🍒⛏🤖

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Feb 16, 2026
@raminfp @miss-islington
pythongh-144833: Fix use-after-free in SSL module when SSL_new() fails (
8e5182b 
pythonGH-144843)

In newPySSLSocket(), when SSL_new() returns NULL, Py_DECREF(self)
was called before _setSSLError(get_state_ctx(self), ...), causing
a use-after-free. Additionally, get_state_ctx() was called with
self (PySSLSocket*) instead of sslctx (PySSLContext*), which is
a type confusion bug.

Fix by calling _setSSLError() before Py_DECREF() and using
sslctx instead of self for get_state_ctx().
(cherry picked from commit c91638c)

Co-authored-by: Ramin Farajpour Cami <ramin.blackhat@gmail.com>
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Feb 16, 2026
@raminfp @miss-islington
pythongh-144833: Fix use-after-free in SSL module when SSL_new() fails (
e795673 
pythonGH-144843)

In newPySSLSocket(), when SSL_new() returns NULL, Py_DECREF(self)
was called before _setSSLError(get_state_ctx(self), ...), causing
a use-after-free. Additionally, get_state_ctx() was called with
self (PySSLSocket*) instead of sslctx (PySSLContext*), which is
a type confusion bug.

Fix by calling _setSSLError() before Py_DECREF() and using
sslctx instead of self for get_state_ctx().
(cherry picked from commit c91638c)

Co-authored-by: Ramin Farajpour Cami <ramin.blackhat@gmail.com>
@bedevere-app
Copy link

bedevere-app bot commented Feb 16, 2026

GH-144858 is a backport of this pull request to the 3.14 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.14 bugs and security fixes label Feb 16, 2026
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Feb 16, 2026
@raminfp @miss-islington
pythongh-144833: Fix use-after-free in SSL module when SSL_new() fails (
13f0581 
pythonGH-144843)

In newPySSLSocket(), when SSL_new() returns NULL, Py_DECREF(self)
was called before _setSSLError(get_state_ctx(self), ...), causing
a use-after-free. Additionally, get_state_ctx() was called with
self (PySSLSocket*) instead of sslctx (PySSLContext*), which is
a type confusion bug.

Fix by calling _setSSLError() before Py_DECREF() and using
sslctx instead of self for get_state_ctx().
(cherry picked from commit c91638c)

Co-authored-by: Ramin Farajpour Cami <ramin.blackhat@gmail.com>
@bedevere-app
Copy link

bedevere-app bot commented Feb 16, 2026

GH-144859 is a backport of this pull request to the 3.13 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.13 bugs and security fixes label Feb 16, 2026
@bedevere-app
Copy link

bedevere-app bot commented Feb 16, 2026

GH-144860 is a backport of this pull request to the 3.12 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.12 only security fixes label Feb 16, 2026
@bedevere-app
Copy link

bedevere-app bot commented Feb 16, 2026

GH-144861 is a backport of this pull request to the 3.11 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.11 only security fixes label Feb 16, 2026
@bedevere-app
Copy link

bedevere-app bot commented Feb 16, 2026

GH-144862 is a backport of this pull request to the 3.10 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.10 only security fixes label Feb 16, 2026
gpshead pushed a commit that referenced this pull request Feb 16, 2026
@miss-islington @raminfp
[3.13] gh-144833: Fix use-after-free in SSL module when SSL_new() fai…
37f818c 
…ls (GH-144843) (#144859)

gh-144833: Fix use-after-free in SSL module when SSL_new() fails (GH-144843)

In newPySSLSocket(), when SSL_new() returns NULL, Py_DECREF(self)
was called before _setSSLError(get_state_ctx(self), ...), causing
a use-after-free. Additionally, get_state_ctx() was called with
self (PySSLSocket*) instead of sslctx (PySSLContext*), which is
a type confusion bug.

Fix by calling _setSSLError() before Py_DECREF() and using
sslctx instead of self for get_state_ctx().
(cherry picked from commit c91638c)

Co-authored-by: Ramin Farajpour Cami <ramin.blackhat@gmail.com>
gpshead pushed a commit that referenced this pull request Feb 16, 2026
@miss-islington @raminfp
[3.14] gh-144833: Fix use-after-free in SSL module when SSL_new() fai…
53b8e64 
…ls (GH-144843) (#144858)

gh-144833: Fix use-after-free in SSL module when SSL_new() fails (GH-144843)

In newPySSLSocket(), when SSL_new() returns NULL, Py_DECREF(self)
was called before _setSSLError(get_state_ctx(self), ...), causing
a use-after-free. Additionally, get_state_ctx() was called with
self (PySSLSocket*) instead of sslctx (PySSLContext*), which is
a type confusion bug.

Fix by calling _setSSLError() before Py_DECREF() and using
sslctx instead of self for get_state_ctx().
(cherry picked from commit c91638c)

Co-authored-by: Ramin Farajpour Cami <ramin.blackhat@gmail.com>
@raminfp raminfp deleted the fix-ssl-uaf-newPySSLSocket branch February 16, 2026 03:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gpshead gpshead gpshead approved these changes

@picnixz picnixz Awaiting requested review from picnixz picnixz is a code owner

Assignees

@gpshead gpshead

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Use-after-free and type confusion in newPySSLSocket() when SSL_new() fails

2 participants

@raminfp @gpshead